Hi Andres

Fixed on r1-3-1 branch (cvs co -r r1-3-1 -P torcs). I will continue soon with the other printf's.

Best regards

Bernhard

On 02/03/2012 05:00 PM, Andres Gomez wrote:

Hi Bernhard,

I have found another exploitable buffer overflow in torcs, this time it
does'nt have relation with plib.
The problem is in:

torcs/src/modules/graphic/ssgraph/grsound.cpp, line 103:

96     char filename[512];
        FILE *file = NULL;

        // ENGINE PARAMS
        tdble rpm_scale;
        param = GfParmGetStr(handle, "Sound", "engine sample",
"engine-1.wav");
        rpm_scale = GfParmGetNum(handle, "Sound", "rpm scale", NULL, 1.0);
103   sprintf (filename, "cars/%s/%s", car->_carName, param);
        file = fopen(filename, "r");
        if (!file)
        {
107             sprintf (filename, "data/sound/%s", param);
        }
        else
        {
            fclose(file);
        }

As you know this section reads a configuration sound option from
[any-car].xml, for example:

<section name="Sound">
<attstr name="engine sample" val="renault-v10.wav"/>
<attnum name="rpm scale" val="0.35"/>
</section>

if audio file name in "engine sample" is enough long it could overwrite
"filename" buffer (line 96),
because there is not size validation in line 103 (also in line 107).
Solution would be again to use snprintf taking care of buffer's size (512).

Any question is welcome ;)

Regards.

Andrés Gómez